Jason A. Donenfeld, WireGuard VPN's author, introduced the WireGuardNT project, which develops a high-performance VPN port of WireGuard for the Windows kernel, compatible with Windows 7, 8, 8.1, and 10, and supports AMD64, x86, ARM64, and ARM architectures. The implementation code is distributed under the GPLv2 license. The new driver is already included in the WireGuard client for Windows, but it is currently marked as experimental and not enabled by default. <\/p>\n
The port is based on the proven codebase of the main WireGuard implementation for the Linux kernel, which has been translated to use Windows kernel entities and the NDIS network stack. Compared to the previously available Windows implementation wireguard-go, which operated in user space and used the Wintun network interface, WireGuardNT offers a significant performance boost by eliminating context switching and copying of packet contents from the kernel to user space. Similar to implementations for Linux, OpenBSD, and FreeBSD, in WireGuardNT, all protocol processing logic operates directly at the network stack level. <\/p>\n
Although specific optimizations have not yet been conducted, WireGuardNT has already achieved peak data transfer performance of 7.5Gbps in the existing testing environment with Ethernet. On real user systems with Wi-Fi, performance is noticeably lower but not significantly different from direct data transmission. For example, in a system with an Intel AC9560 wireless card, the bandwidth without WireGuard was 600Mbps, and with WireGuardNT, it remained at 600Mbps, while using wireguard-go\/Wintun it was 95Mbps. <\/p>\n
peamine VPN<\/a> WireGuard p\u00f5hineb kaasaegsetel kr\u00fcpteerimismeetoditel, tagab v\u00e4ga k\u00f5rge j\u00f5udluse, on lihtne kasutada, on vaba keerukusest ja on end t\u00f5estanud mitmetes suurtes rakendustes, mis t\u00f6\u00f6tlevad suures mahus liiklust. Projekt on arenenud alates 2015. aastast, l\u00e4binud auditi ja ametliku valideerimise kasutatavatele kr\u00fcpteerimismeetoditele. WireGuardis rakendatakse v\u00f5tmete kr\u00fcpteerimise kaudu marsruutimise kontseptsiooni, mis h\u00f5lmab iga v\u00f5rgu liidese kinnise v\u00f5tme sidumist ja avalike v\u00f5tmete seondamise rakendamist. <\/p>\n \u00dchenduse loomise avatud v\u00f5tmete vahetus toimub SSH-i sarnaselt. V\u00f5tmete kokkuleppimiseks ja \u00fchenduse loomiseks ilma eraldi kasutaja ruumi deemonit k\u00e4itata kasutatakse Noise Protocol Frameworki Noise_IK mehhanismi, mis sarnaneb SSH autoriseeritud v\u00f5tmete haldamisega. Andmed edastatakse UDP-pakettidesse kapseldatuna. Toetatakse vahetust IP-aadressid<\/a> VPN-serverid (roaming) katkestusteta \u00fchenduse hoidmine automaatse kliendi seadistamisega. <\/p>\n Kr\u00fcptimiseks kasutatakse voogkr\u00fcptereid ChaCha20 ja s\u00f5numi autentimise algoritmi (MAC) Poly1305, mille on v\u00e4lja t\u00f6\u00f6tanud Daniel Bernstein, Tanja Lange ja Peter Schwabe. ChaCha20 ja Poly1305 on turundatud kui kiiremad ja turvalisemad analoogid AES-256-CTR ja HMAC, mille programmiline rakendus v\u00f5imaldab saavutada fikseeritud t\u00e4itmise aega ilma spetsiaalset riistvara tuge kasutamata. \u00dchise salajase v\u00f5tme genereerimiseks kasutatakse elliptsete k\u00e4ivete Difii-Hellmani protokolli Curve25519 rakenduses, mis on samuti ettepaneku Daniel Bernsteinilt. Hashimise jaoks kasutatakse algoritmi BLAKE2s (RFC7693). <\/p>\n